search

Azure / Enterprise-Scale

The Azure Landing Zones (Enterprise-Scale) architecture provides prescriptive guidance coupled with Azure best practices, and it follows design principles across the critical design areas for organizations to define their Azure architecture
https://aka.ms/alz
MIT License
1.69k stars 963 forks source link

Fixes bug with ama role assignments #1593

Closed arjenhuitema closed 6 months ago

arjenhuitema commented 6 months ago

Overview/Summary

Resolved an issue that prevented the policy remediation from working properly for VM Insights and Change Tracking policies. The root cause was the insufficient access granted to the Managed Identity that performs the remediation task. To solve the problem, we granted the Policy Assignments in the Landing Zone Management the permission to read the Platform Management Group.

This PR fixes/adds/changes/removes

  1. Adds Role Assignments to VMInsights Policies at LZs MG granting rbacReader on Platform MG
  2. Adds Role Assignments to ChangeTracking Policies at LZs MG granting rbacReader on Platform MG
  3. Adds Role Assignments to Azure Update Manger Policies, granting rbacManagedIdentityOperator at the same scope as the assignment.

Breaking Changes

None

Testing Evidence

Deployment

image

Compliance Monitoring

image

Compliance Change Tracking

image

Compliance Azure Update Manager

image

Testing URLs

Azure Public

Deploy To Azure

As part of this Pull Request I have